MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 818ecb16437ac935be7021c4be5efbec2ebdd2e9ffc78797aa1b91743746954b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 818ecb16437ac935be7021c4be5efbec2ebdd2e9ffc78797aa1b91743746954b
SHA3-384 hash: f3e5f9f0a6ca20d75b636bc8b68522f78df28534db658bb78925f68d860a2f63a1045ea27c6454fe238e9d425934d1b6
SHA1 hash: 34c8036142fcc37d551008eb3c5cadeb69fba32c
MD5 hash: 2b360ce5f57a81f17d65c905345f8cad
humanhash: blossom-tennis-magnesium-xray
File name:PO 33091221.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'111'762 bytes
First seen:2020-06-15 13:20:05 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 24576:mbUGmJplCSwU8dbIyM5gYCQ5eZv3aArMNyUiKZiWCpwqcz:mbUGApH8xICLQciKM4Hpm
TLSH 5435336363B8B13546A6617D42B73B5170210F88BF46370B77773C29D99C78A92AB0BC
Reporter abuse_ch
Tags:AgentTesla uue Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic307-56.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.190.31
From: Sales manager <noahjacob51@yahoo.com>
Reply-To: Sales manager <noahjacob51@yahoo.com>
Subject: Fw: URGENT PURCHASE ORDER
Attachment: PO 33091221.uue (contains "PO 33091221.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:22:05 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qghmwfsdpletlptqehcl4xx35qxl3uxj77dypf5kdoixin2gsvfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 818ecb16437ac935be7021c4be5efbec2ebdd2e9ffc78797aa1b91743746954b

(this sample)

AgentTesla

Executable exe 772d2f2ea97be3c0b9948701fb6743fc8f717680420fe5ce0101eac3ac6cd1c7

  
Dropping
MD5 1d03a018b5b435a2e9ea27e0c10daeb7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 772d2f2ea97be3c0b9948701fb6743fc8f717680420fe5ce0101eac3ac6cd1c7

Comments